A digital signature (not to be confused with a digital certificate) is an electronic signature that is used to authenticate the identity of a message sender or document signer, and usually to ensure that the original message/document content is unchanged (document integrity).

learn more… | top users | synonyms (1)

10
votes
3answers
329 views

Is this a weakness of enveloped XML signature?

There might be a problem in many applications based on XML signature verification (provided I am not wrong, of course). Let's have a simple XML message with an enveloped XML signature: <?xml ...
1
vote
2answers
40 views

RSA blind signature vs signing a hash

My understanding is that the key feature of a blind RSA signature is that the signer is unaware of the contents of the message being signed. How is this different from simply hashing some data and ...
2
votes
1answer
255 views

Microsoft and SHA-1 deprecating on Windows 7

Microsoft states: Effective January 1, 2016, Windows (version 7 and higher) and Windows Server will no longer trust any code that is signed with a SHA-1 code signing certificate and that ...
14
votes
7answers
7k views

Deprecation of SHA1 code signing certificates on Windows

I have been keenly following the issues with regards to Microsoft deprecating the use of SHA1 code-signing certificates for Windows executables ...
3
votes
2answers
72 views

Sign a callback URL

I have a Single Sign-On system that works this way : User clicks link on clientsite.com that redirect him to mastersite.com?returnTo=http://clientsite.com If auth is valid, the user is redirected ...
4
votes
2answers
121 views

Why would some Windows executables not have a “Digital Signatures” tab?

Why would some executable on a Windows 7 system not have a "Digital Signatures" tab? (With this question I am referring to those executables that are not part of Windows OS and to which the ...
3
votes
0answers
41 views

Can I do an enveloping XAdES signature on binary content?

I need to sign some binary content (scanned documents) with a digital signature compliant with European norms, CAdES - XAdES. One option would be to use this library to do a XAdES signature. Is there ...
5
votes
2answers
140 views

How do I produce a CA signed public key?

I have a need to have somebody else encrypt secret data with my public key that I can then decrypt with my private key. I have produced an RSA private/public key pair with OpenSSL gave them the public ...
3
votes
1answer
60 views

Verification of a timestamped PDF

I'm kinda new to the process of timestamping files to provide digital integrity. For testing purposes, i use tsa.safecreative.org for PDF files. Now i've signed a couple PDF files and if i open up ...
3
votes
0answers
65 views

How does a Sign tool work?

My basic understanding about sign tool is: 1.It loads the zipfile(may be exe,jar,ddl,apk..) which has to be signed to its memory(cache memory of the sign tool). 2.It will verify it, and unzip the ...
3
votes
2answers
108 views

Client side signing of a file(.exe,.dll,.jar..) using CA issued certificate and signtool [closed]

In a current project we have purchased certificate from a trusted CA and have installed in a host, sign tool is also installed in the same host. All the files which we develop(jar,dll,apk,exe etc..,) ...
7
votes
1answer
71 views

Subresource Integrity versus signing

The draft spec for subresource integrity is straightforward: This document specifies such a validation scheme, extending two HTML elements with an integrity attribute that contains a ...
1
vote
0answers
86 views

CMS signed data OpenSSL verification error

I have a CMS signed data that is successfully verified through Java BouncyCastle library. When trying to verify through OpenSSL, I am getting the following error: >openssl smime -verify -inform ...
0
votes
1answer
18 views

Standard digital signature data representation

I am creating digital signatures using various scheme, e.g. RSASSA-PSS. The result is bytes that represents signed data with private key. I would like to store signature as a standard data ...
2
votes
1answer
89 views

Strategy for electronic document (PDF) signatures

I'm treading into the murky waters of electronic document signatures, and I'm having trouble figuring out the right approach to deal with my requirements. I think this should be pretty ...
0
votes
1answer
35 views

For X.509 Certificates where is the actual digital signature?

When you open up the certificate information from your browser and go to the details tab there is a bunch of information for various certificate fields. I am wondering which field contains the actual ...
0
votes
5answers
161 views

How to make sure nobody has read this!

Is there any computer/server which would allow me to get "guaranteed read access history" for files? For example, suppose I made a file with my plaintext passwords and simply wanted to make sure that ...
2
votes
2answers
85 views

Is this a secure Digital Signature + Encryption method?

I am trying to wrap my head around Digital Signatures and how RSA Encryption supports them. And which order to do them along with what specifically to encrypt. So say we have Alice and Bob and a ...
2
votes
1answer
40 views

what is worth a digital signature based on email address only? [closed]

I have noticed that most digital signature providers do not try to certify anything but an e-mail address, while it is quite easy to create an email address without disclosing any personal ...
0
votes
0answers
35 views

Smartcard authentification: encrypt/decrypt or ECDSA?

I'm implementing a simple door access control with smart keyfobs. At the moment I send a 32 byte message to the keyfob which it signs with ECDSA and I verify the authenticity with the public key. ...
0
votes
0answers
48 views

deceptive digital signature?

I am new to cyphering and I try to understand this case : my government sends me so-called "digitally signed" PDFs, as you can see below (text only, after "Thanks"). Although there is a certificate ...
1
vote
2answers
58 views

Public Key Infrastructure: Sending data securely to CLIENT?

Ok, so been looking up public key encryption and using it a bit around some of my web applications. From some testing, I understand that the server contains two keys and sends the public key to the ...
2
votes
1answer
616 views

OpenSSL check if a SSL certificate is SHA-1 or SHA256 signed

How do I check if an OpenSSL certificate issued to a site is SHA-1 or SHA-256? I have a quite a lot of intranet sites using OpenSSL certificates and I am a bit confused as when I check the certificate ...
4
votes
3answers
138 views

Is there a way to prove some content came from a specific website?

I guess we can all agree that a screenshot of a website proves nothing; one can edit the HTML as much as one likes, take a screenshot and show a website displaying false information. As far as I ...
0
votes
1answer
34 views

Authentication using a digital signiture

I'm new to the world of digital signatures and encryption and I'm trying to learn more. I was wondering, how or if an authentication process (login or sign-in) can be performed using a digital ...
2
votes
1answer
82 views

In the context of advanced electronic signatures, what does “sole control” mean?

To satisfy the conditions for an advanced or qualified electronic signature, the power to sign must remain under the "sole control" of the signatory. Can anyone provide concrete examples of what this ...
3
votes
1answer
124 views

Need raw certificate/key to sign PDFs via Java app. But vendors seem to only sell HSMs for this. What to do?

Our organisation wants to purchase a digital signature certificate for signing financial PDF documents. We want to automate this process, so we'll be having Java code do the signing work. For that the ...
2
votes
1answer
276 views

Make signed file from content file and its detached signature?

I have a text file which I will call filename.txt. Firstly I call gpg --output filename.asc --clearsign filename.txt Signed file filename.asc is created. Then I call gpg --armor --output ...
2
votes
1answer
85 views

signature and padding

I use JcaContentSignerBuilder to sign a self-signed certificate but I don't know what the default padding is. My requirement is that I must NOT use PKCS#1.5 padding. The code I use is below - can ...
1
vote
2answers
149 views

What are some Linux commands for genrating and verifying digital signatures?

I am attempting a workflow to exemplify the process of digital signature using asymmetric cryptography. If I understand correctly then the public key and the private key in an asymmetric ...
1
vote
1answer
41 views

How is the signing of an OpenPGP public key realized technically?

I recently have signed the public OpenPGP key of a friend of mine. Curious to see, which effect this would have on the actual key, I compared the key before and after signing it. What I found was that ...
0
votes
1answer
52 views

Long term trust anchor validation

Let's say someone signs a document for long term validation using a certificate issued by a trusted CA. Throughout the following years, the document is timestamped again and again by multiple trusted ...
2
votes
1answer
92 views

Generating Own SSL certificate using DSC issued by a CA

Ok. So, here is what I know: SSL Certificate are used to verify domain for HTTPS protocol. These are issued by a root CA to ensure that it can be trusted by anyone using the website and trusting the ...
1
vote
2answers
76 views

Is this explanation about how SSL Certificate Signatures work correct?

I was reviewing some information about SSL certificates and came across an explanation I believe to be incorrect. The explanation is of how signatures and hashing algorithms work in the context of ...
0
votes
3answers
129 views

In message signing, is the digest encrypted with a generated symmetric key or with the sender's private key?

I understand the encryption process uses a generated symmetric key to encrypt a message, and then encrypts the symmetric key with the receiver's public key before it is sent across the wire. This ...
7
votes
2answers
361 views

Is a mail secure if it's PGP-encrypted, but unsigned when sent with DKIM?

I run my own mail server and would like to use different addresses on the same domain. If I were to sign mails from those addresses, I'd have to generate new PGP keys for each and every one of them. ...
2
votes
2answers
61 views

What problem does PKI fix; how would someone “lie about their identity”? [duplicate]

What does having a certificate issued by a Content Authority protect against? In everything I've red (and watched) they teach it as "you are given the public key to communicate with Alice, but how do ...
4
votes
2answers
145 views

What is the difference between the “sig” files and the checksum files, such as on the PuTTY download page?

This is about the functional differences between sig files and checksum files and how they can be used by a user downloading some software. For example, on the PuTTY download page both sig files and ...
3
votes
2answers
101 views

Digital signature: How do I know what I'm signing?

Suppose I have to sign a PDF form. If I'm using (say) Acrobat Reader and a hardware security token, at some point I will be prompted for a PIN to authorize the token to sign the document. How can ...
3
votes
3answers
98 views

Central auth service redirecting to subdomain, using digital signature as auth token

I'm working on a "proof of concept" of a central auth service (not CAS). There are holes in my understanding of what I need to do, and I have concerns that the "protocol" is not secure. Why/What ...
2
votes
1answer
80 views

Correct way of signing and verifying a message

I have an object which I need to transmit to clients and I need the clients to know that I actually created the object. Obviously, this process involves in me signing the object with my private key, ...
1
vote
1answer
95 views

Where does the list of trusted content authorities come from when using a web browser?

I was asked "how do browsers know whether or not to trust the certificate from the server it's connecting to" and thought it was a pretty good question. After doing some googling I found two answers: ...
2
votes
2answers
308 views

End to end security for REST services, any emerging standards?

I work with integration in the healthcare sector, where end-to-end security is important. We integrate with numerous SOAP services, and use the WS-security features to encrypt and sign requests and ...
1
vote
1answer
68 views

Need asymmetric encryption(not signing) where server encrypts and client decrypts

So I'm trying to build a licensing server, where the licenses of the applications need to be checked when logging in or when the application gets used. But some of those application work offline most ...
2
votes
1answer
63 views

How do key pairs work especially in the context of cryptographic signatures?

Is it the case that any message encrypted with a private key can be decrypted with its matching public key and any message encrypted with a public key can be decrypted with the matching private key ...
1
vote
2answers
108 views

Specific clarification on how https server public key is trusted

I know the general concept of how digital certificates works: e.g. server "signs" the message it wants to send to the client using his private key and sends along a message digest and on the receiving ...
0
votes
1answer
126 views

Encryption and Signature with same RSA private key

Talking about cipher-suites that use RSA both for sign of DH parameters and for digital signature. The keys used for these process are the same, or is there a public and private key for each one? If ...
0
votes
1answer
121 views

Certificate - Digital fingerprint vs Signature [duplicate]

What is the purpose of the « fingerprint » section of a x509 certificate, and is there an issue using SHA1 for it ? I understand the certificate signature section, but I can’t see the point with the ...
0
votes
1answer
99 views

Code signing certificate validation by Java

Despite several web search, I can’t find an accurate explanation on code signing certificate validation by Java. Indeed, I am wondering if the code signing certificate (the “final cert”) must already ...
1
vote
2answers
141 views

Where is my missunderstanding in how digital signatures are used with licence files to allow program to run?

I'm trying to learn how digitally signing a licence file helps prevent piracy. For example say an application only runs if it verifies the date as specified in a licence file has not past. Obviously ...